Security Headers Checker / Headers / CDNs and hosts

Security headers on Cloudflare

A baseline set of security headers for Cloudflare: HSTS, a Content-Security-Policy in Report-Only mode to start, framing protection, nosniff, a private Referrer-Policy, a Permissions-Policy and the cross-origin headers. Check what each can break below before you deploy, then scan your site to confirm.

The headers

Dashboard: Rules > Transform Rules > Modify Response Header > Create rule.
If incoming requests match: All incoming requests.
Then, for each header: Set static.
  Header name: Strict-Transport-Security
  Value: max-age=31536000; includeSubDomains
  Header name: Content-Security-Policy-Report-Only
  Value: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests
  Header name: X-Frame-Options
  Value: SAMEORIGIN
  Header name: X-Content-Type-Options
  Value: nosniff
  Header name: Referrer-Policy
  Value: strict-origin-when-cross-origin
  Header name: Permissions-Policy
  Value: camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()
  Header name: Cross-Origin-Opener-Policy
  Value: same-origin-allow-popups
  Header name: Cross-Origin-Resource-Policy
  Value: same-site
Deploy. (HSTS also has its own switch: SSL/TLS > Edge Certificates > HSTS.)

Will this break anything?

• Strict-Transport-Security: once a browser has seen it, it refuses plain HTTP for this host for max-age seconds (and with includeSubDomains for every subdomain: mail, staging, old tools). Check they all serve HTTPS, start with max-age=300, then raise it. preload is very hard to undo.
• Content-Security-Policy-Report-Only blocks nothing: browsers only report what an enforced policy would block, so it is safe to add first and watch.
• X-Frame-Options: DENY stops every site from framing yours, including your own other domains, booking or payment widgets that frame your pages, and page-builder previews. SAMEORIGIN allows your own origin.
• X-Content-Type-Options: browsers refuse scripts and stylesheets served with the wrong Content-Type (a script sent as text/plain): check your files are served with correct types.
• Referrer-Policy: sites you link to see less about where visitors came from. strict-origin-when-cross-origin still sends your origin, which most referral reports need; no-referrer sends nothing.
• Permissions-Policy: a feature set to () is off for the page and every frame in it, including embedded maps, videos, payment buttons and chat widgets. Check what your page and its embeds use first.
• Cross-Origin-Opener-Policy: same-origin breaks pop-ups that talk back to your page (OAuth sign-in, PayPal and some payment windows); same-origin-allow-popups keeps them working.
• Cross-Origin-Resource-Policy: same-site or same-origin stops other sites from embedding your files (images, fonts, scripts). Files other sites embed on purpose need cross-origin.

Redirect HTTP to HTTPS

Dashboard: SSL/TLS > Edge Certificates > Always Use HTTPS: On.

Cookie flags

Set the flags where the cookie is created (your app). A Cloudflare Worker can rewrite Set-Cookie, but fixing it at the source is safer.